Extracted

• • Target

    JaffaCakes118_9b5747af135d7ffcb167118aa1067849

  • Size

    30KB

  • MD5

    9b5747af135d7ffcb167118aa1067849

  • SHA1

    1cac7f06be7babf46b0a843b5bd3b668f9f3ea81

  • SHA256

    7338403b364a468c18875324609f16e2201a2ea452d410ec960763b8b3c902e5

  • SHA512

    bba8095311ac64a5992953a4e0f1b1de9b25c6c137bc724275a16256ac6b4d15c04673404f05f28dd07f3cd9a85bb0b15d1acc09f539df102bd86a55e1719251

  • SSDEEP

    768:myvYLznDEB2iC+sDqC6NtxsfzxPnNsGbog71wtK8WXmJgGlzDpbuR1J2:BYnnDEBI+smATfogGtlVJu8

  Score

  10^/10

  mirailzrdbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (20108) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1